Processing email messages based on authenticity analysis

In an electronic system, a method of processing an email message, the method comprising:

• receiving the email message from a network;
• performing an authenticity analysis operation to determine authenticity of the email message;
• and
• forwarding a copy of the email message to an external central hub through the network when a result of the authenticity analysis operation indicates that the email message is not authentic, and refraining from sending the copy of the email message to the external central hub through the network when the result of the authenticity analysis operation indicates that the email message is authentic;
• wherein performing the authenticity analysis operation to determine authenticity of the email message includes:
• generating a risk score based on the email message, and
• providing, as the result of the authenticity analysis operation, (i) a first value indicating that the email message is not authentic when the risk score exceeds a predetermined threshold, and (ii) a second value indicating that the email message is authentic when the risk score does not exceed the predetermined threshold;
• and
• wherein generating the risk score based on the email message includes:
• generating multiple sub-scores corresponding to multiple risk criteria, each sub-score identifying a degree to which the email message fits a particular risk criteria, and
• outputting, as the risk score, an aggregate value including a sum of the multiple sub-scores corresponding to the multiple risk criteria.

An electronic system, comprising:

• a network interface which is constructed and arranged to connect to a network;
• and
• a controller coupled to the network interface, the controller being constructed and arranged to:
• receive an email message from the network through the network interface,
• perform an authenticity analysis operation to determine authenticity of the email message, and
• forward a copy of the email message to an external central hub through the network interface when a result of the authenticity analysis operation indicates that the email message is not authentic, and refrain from sending the copy of the email message to the external central hub through the network interface when the result of the authenticity analysis operation indicates that the email message is authentic;
• wherein the controller, when performing the authenticity analysis operation to determine authenticity of the email message, is constructed and arranged to:
• generate a risk score based on the email message, and
• provide, as the result of the authenticity analysis operation, (i) a first value indicating that the email message is not authentic when the risk score exceeds a predetermined threshold, and (ii) a second value indicating that the email message is authentic when the risk score does not exceed the predetermined threshold.

A computer program product having a non-transitory computer readable medium which stores a set of instructions that, when performed by a computerized device, cause the computerized device to:

• receive an email message from a network;
• perform an authenticity analysis operation to determine authenticity of the email message;
• and
• forward a copy of the email message to an external central hub through the network when a result of the authenticity analysis operation indicates that the email message is not authentic, and refrain from sending the copy of the email message to the external central hub through the network when the result of the authenticity analysis operation indicates that the email message is authentic;
• wherein performing the authenticity analysis operation to determine authenticity of the email message includes:
• generating a risk score based on the email message, and
• providing, as the result of the authenticity analysis operation, (i) a first value indicating that the email message is not authentic when the risk score exceeds a predetermined threshold, and (ii) a second value indicating that the email message is authentic when the risk score does not exceed the predetermined threshold.